Skip to main content

SSH Command Tracking Guide

Part 1: Arch Linux

Arch Linux uses theThe Linux Audit Framework (auditd) tocaptures captureexecve system calls (execve) triggered by human loginuser sessions (auid >= 1000).

1. Installation & Service Setup

Install the audit package and enable the auditd daemon:

$ sudo pacman -S --noconfirm audit
$ sudo systemctl enable --now auditd

2. Configuration Rules

Create /etc/audit/rules.d/execve.rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << 'EOF'EOF
# Delete pre-existing rules
-D

# BufferSet kernel buffer size
-b 8192

# Log all command executions for human/login users (auid >= 1000)
-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands
EOF

Load rules into the active kernel:

$ sudo augenrules --load
$ sudo auditctl -e 1

Verify active rules:

$ sudo auditctl -l

3. QueryingReal-Time Command LogsInspection (audit-log)

InspectQuery commandscommand recordedexecutions byusing the high-speed auditdaudit-log: helper script:

# QueryView recordedthe executionlast logs20 forexecuted remote_commandscommands (Default)
$ sudo ausearch -k remote_commands -iaudit-log

# StreamView rawa auditspecific eventsnumber inof realrecent timecommands (e.g. 50 entries)
$ sudo audit-log 50

# View ALL recorded command history
$ sudo audit-log all

# Count total logged command executions
$ sudo audit-log all | wc -l

Sample Output:

2026-08-09 13:06:51 | sudo audit-log 20
2026-08-09 13:06:51 | tail -fn /var/log/audit/audit.log20
2026-08-09 13:06:51 | grep/usr/bin/unix_chkpwd "type=EXECVE"root chkexpiry

Part 2: OpenBSD (Router danknasty)

OpenBSD uses native kernel process accounting (acct) to logtrack processbinary executions, combinedalongside withsyslog-based sshd verbose logging and doas syslog auditing.

1. Kernel Process Accounting (acct)

Process accounting logs every binary execution on the system to /var/account/acct.

Enable Accounting:

# Create log file
$ doas touch /var/account/acct

# Enable accounting at boot
$ echo "accounting=YES" | doas tee -a /etc/rc.conf.local

# Start accounting daemon immediately
$ doas /usr/sbin/accton /var/account/acct

2. Real-Time Command Inspection (audit-log)

Query Executionprocess History:execution

Usehistory using the matching lastcommaudit-log tohelper query executed commands:script:

# View the last 20 executed commands (Default)
$ doas audit-log

# View a specific number of recent commands (e.g. 50 entries)
$ doas audit-log 50

# View ALL recorded command history
$ doas audit-log all

recent# Count total logged command executions
$ lastcommdoas #audit-log Viewall executions| bywc user-l
'luke'
$

Sample Output:

2026-08-09 13:06:00 | date
2026-08-09 13:06:00 | chmod
2026-08-09 13:06:00 | tee
2026-08-09 13:06:00 | lastcomm luke

# View executions of specific binary
$ lastcomm pfctl

2.3. SSH Verbose Payload & doas Logging

To log non-interactive SSH connections and payload commands to /var/log/authlog:

  1. Edit /etc/ssh/sshd_config: 
    LogLevel VERBOSE
  2. Reload sshd: 
    $ doas rcctl reload sshd
  3. Monitor logs: 
    $ doas tail -f /var/log/authlog

3. Privilege Escalation Logs (doas)

OpenBSD automatically logs all elevated doas commands to /var/log/authlog:

$ doas grep doas /var/log/authlog